Bug 521207 - tiles do not work if they extend beyond the filter subregion bounds

content/svg/content/src/nsSVGFilters.cpp

@@ -2867,10 +2867,15 @@ nsSVGFETileElement::Filter(nsSVGFilterInstance *instance,
   NS_ENSURE_SUCCESS(res, res); // asserts on failure (not 
   if (tile.IsEmpty())
     return NS_OK;
-  NS_ENSURE_TRUE(instance->GetSurfaceRect().Contains(tile), NS_ERROR_UNEXPECTED);
+
+  const nsIntRect &surfaceRect = instance->GetSurfaceRect();
+  if (!tile.Intersects(surfaceRect)) {
+    // nothing to draw
+    return NS_OK;
+  }
 
   // Get it into surface space
-  tile -= instance->GetSurfaceRect().TopLeft();
+  tile -= surfaceRect.TopLeft();
 
   PRUint8* sourceData = aSources[0]->mImage->Data();
   PRUint8* targetData = aTarget->mImage->Data();
@@ -2882,12 +2887,16 @@ nsSVGFETileElement::Filter(nsSVGFilterInstance *instance,
   nsIntPoint offset(-tile.x + tile.width, -tile.y + tile.height);
   for (PRInt32 y = rect.y; y < rect.YMost(); y++) {
     PRUint32 tileY = tile.y + WrapInterval(y + offset.y, tile.height);
+    if (tileY < surfaceRect.height) {
       for (PRInt32 x = rect.x; x < rect.XMost(); x++) {
         PRUint32 tileX = tile.x + WrapInterval(x + offset.x, tile.width);
+        if (tileX < surfaceRect.width) {
           *(PRUint32*)(targetData + y * stride + 4 * x) =
             *(PRUint32*)(sourceData + tileY * stride + 4 * tileX);
         }
       }
+    }
+  }
 
   return NS_OK;
 }

layout/reftests/svg/filters/feTile-large-01.svg

@@ -0,0 +1,19 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/licenses/publicdomain/
+-->
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <title>Testcase for tile larger than surface</title>
+
+    <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=521207 -->
+    <defs>
+        <filter primitiveUnits="objectBoundingBox" filterUnits="objectBoundingBox" 
+                id="filter_1" x="-50%" y="-50%" width="200%" height="200%">
+            <feTile />
+        </filter>
+    </defs>
+
+    <rect width="100%" height="100%" fill="lime" />
+    <rect x="10" y="10" width="100" height="100" fill="red" />
+    <rect x="10" y="10" width="100" height="100" fill="lime" style="filter:url(#filter_1);"/>
+</svg>

layout/reftests/svg/filters/reftest.list

@@ -74,3 +74,5 @@ fails == filter-marked-line-01.svg pass.svg # bug 477704
 == feMorphology-radius-negative-02.svg pass.svg
 == feMorphology-radius-zero-01.svg pass.svg
 == feMorphology-radius-zero-02.svg pass.svg
+
+== feTile-large-01.svg pass.svg